DCE/RPC inspection on ASA/PIX/FWSM
"Distributed Computing Environment / Remote Procedure Calls", is the remote procedure call system developed for the Distributed Computing Environment (DCE). This system allows programmers to write distributed software as if it were all working on the same computer, without having to worry about the underlying network code.
DCERPC inspection module is responsible for processing the data portion of the packet and performing inspection related tasks such as applying translations to IP addresses and ports contained in the packet when applicable, opening secondary channel etc., with the help of other modules
Since FWSM version 4.1 the inspectione engine has been redesigned and enhanched by RCI (Remote Create Instance) calls over RPC and the processing of RPC messaging.
Microsoft is no longer just using EPM (End Point Mapper)
As Microsoft switched from using pure RPC to use DCOM (ORPC) calls, those non-epm calls will be used more and more. Windows RPC/DCOM services use the RPC Endpoint Mapper to accept initial communications on port 135 and then dynamically transition to ports for the service.
"The OXID Resolver resides at different endpoints (ports) depending on the transport being used. The OXID Resolver optimally resides at the same endpoints as the DCE RPC Endpoint Mapper (EPM). To accommodate systems where DCOM will coexist with existing DCE RPC installations (i.e., where an EPM and presumably a complete DCE RPC runtime already exists), the DCOM implementation on that system will register its interfaces with the DCE EPM and all DCOM implementations must be able to fall back if they make DCOM -specific calls on the DCE EPM endpoint which fail."
Starting with Windows 2000, the ISystemActivator COM interface is used instead of the IRemoteActivation RPC interface.
The IOXIDResolver RPC interface (formerly known as IObjectExporter) is remotely used to reach the local object resolver (OR). The Object Resolver component is in charge to:
- return protocol sequences, string bindings and machine id for an object server, given its OXID (ResolveOXID() and ResolveOXID2() (only supported by DCOM version 5.2 and above))
- respond to ping requests (SimplePing() and ComplexPing() functions)
- respond to ServerAlive() and ServerAlive2() functions requests
NON-EMP support for ASA/FWSM
Caveats
CSCsk97762 - ENH: Allow DCERPC inspect to open pin-holes for WMI queries. non epm map
CSCto43960 - FWSM: DCERPC inspection of packet with multiple segments fail
CSCtl25658 - TEA ENH: FWSM DCERPC inspection doesn't support 'Remote Create Instanc
Workarounds available
- Enable DCERPC inspection, open all higher ports for the servers
- Disable DCERPC inspection, permit all traffic
For FWSM users: We recommand to try the 4.0.x version if you do not want to completely disable the inspection to let the traffic through.
Config
class-map dcerpc
endpoint-mapper lookup-operation
match port tcp eq 135
policy-map type inspect dcerpc dcerpc_map
parameters
timeout pinhole 0:10:00
policy-map global_policy
class dcerpc
inspect dcerpc dcerpc_map
service-policy global_policy global
In some cases when lookup operations are not passing throught use this config:
class-map MSRPC
match-port tcp eq 135
policy-map type inspect dcerpc MSRPC-MAP
description dcerpc inspection for MAP and LOOKUP ops
parameters
endpoint-mapper epm-service-only lookup-operation
timeout pinhole 00:03:00 ! this timeout applies to pinholes from
lookup-operation
policy-map global-policy
class MSRPC
inspect dcerpc MSRPC-MAP
service-policy global-policy global
Troubleshooting
Debug is available for DCERPC inspection:
debug dcerpc [ packet | error | event ]
no debug dcerpc [ packet | error | event ]
Sample debug:
DCERPC-PKT: bind id:5 - dmz4:saturne/2055 to inside:octans/135.
DCERPC-EV: bind has non-epm uuid 000001a0-0000-0000-c000-000000000046.
DCERPC-EV: bind with ctx_num:2
DCERPC-EV: retrieve ctx_id: 0, if-uuid: 000001a0
DCERPC-EV: retrieve ctx_id: 1, if-uuid: 000001a0
DCERPC-PKT: bind_ack id:5 - inside:octans/135 to dmz4:saturne/2055.
DCERPC-EV: bind_ack with ctxnum_result:2
DCERPC-EV: ctxid/result:0/0 accepted, ack_reason:0 tsyn: 8a885d04
DCERPC-EV: ctxid/result:1/3 rejected, ack_reason:1 tsyn: 00000000
DCERPC-PKT: alter_context id:5 - dmz4:saturne/2055 to inside:octans/135.
DCERPC-EV: alter_context has non-epm uuid 000001a0-0000-0000-c000-000000000046.
DCERPC-EV: alter_context with ctx_num:1
DCERPC-EV: retrieve ctx_id: 0, if-uuid: 000001a0
DCERPC-PKT: alter_context_resp id:5 - inside:octans/135 to dmz4:saturne/2055.
DCERPC-EV: alter_context_resp with ctxnum_result:1
DCERPC-EV: ctxid/result:0/0 accepted, ack_reason:0 tsyn: 8a885d04
DCERPC-PKT: request id:5 - dmz4:saturne/2055 to inside:octans/135.
DCERPC-EV: valid_ctxid: alt:1 ctxnum:1 j:0 val:0 valid:1
DCERPC-PKT: response id:5 - inside:octans/135 to dmz4:saturne/2055.
Very important to collect packet captures if you want to troubleshoot ! This will help for the TAC to gather more information about what kind of DCERPC
communication is passing trough and may be replay on a lab device if it doesn't work or failing.
How to capture, see it here: Packet capture on Firewalls (ASA/PIX/FWSM)
References
DCOM: http://cybertiggyr.com/nmcom/draft-brown-dcom-v1-spec-03.html
ASA DOC: http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/inspect_mgmt.html#wp1488387
MSRPC: http://en.wikipedia.org/wiki/Microsoft_RPC
